fix: limit shared chats to ACL grants (#26123)

2026-09-24 15:04:27 +08:00 · 2026-06-08 12:21:16 +01:00
parent 8ae1a5c766
commit 1e5dd83a95
5 changed files with 101 additions and 28 deletions
@@ -486,7 +486,12 @@ WHERE
        ELSE true
    END
    AND CASE
-        WHEN @shared_only::boolean THEN chats_expanded.owner_id != @viewer_id::uuid
+        WHEN @shared_only::boolean THEN
+            chats_expanded.owner_id != @viewer_id::uuid
+            AND (
+                chats_expanded.user_acl ? (@shared_with_user_id::uuid)::text
+                OR chats_expanded.group_acl ?| @shared_with_group_ids::text[]
+            )
        ELSE true
    END
    AND CASE